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ABSTRACT 


A  simple  error-correcting  circuit  design  employing 
a  majority  charge  technique  is  described.  Use  of  a 
pulse-powered  design,  conventional  integrated  cir¬ 
cuits,  and  a  majority  charge  technique  provides  a 
reliable  error-correction  method  for  redundant  dig¬ 
ital  networks  at  micropower  levels.  The  design  pro¬ 
cedure  is  described  in  terms  of  operating  margins. 
Practical  system  implementation  is  also  provided. 


Accepted  for  the  Air  P^orce 

Franklin  C.  Hudson 

Chief,  Lincoln  Laboratory  Office 


CONTENTS 

Abstract  iii 

I.  Introduction  1 

II.  Redundancy  Concept  1 

III.  Low-Power  Design  2 

IV.  Error-Correction  Process  7 

V.  Component  Failure  20 

VI.  Adaptive  Operation  21 

VII.  Integrated  Circuit  Array  Application  21 


IV 


MICROPOWER  ERROR-CORRECTING 
REDUNDANT  CIRCUIT  DESIGN 


I.  INTRODUCTION 

The  theoretical  analysis  and  potential  advantages  of  redundant  circuit 

1-3 

techniques  have  received  considerable  attention  in  the  literature,  but  prac¬ 
tical  forms  of  redundant  systems  have  not  been  easily  implemented  by  circuit 
designers.  Undoubtedly,  the  major  reason  for  this  limited  use  is  the  result 
of  the  penalty  in  size,  power,  and  complexity  that  is  inherent  in  redundant 
systems. 

For  some  time,  the  integrated  circuit  technology  has  offered  an  opportunity 

to  eliminate  the  size  penalty  of  redundant  designs.  By  combining  pulse-powered 
4 

circuit  operation  and  a  majority  charge  technique  in  an  integrated  circuit  com¬ 
plex,  a  new  form  of  simple,  reliable,  error-correcting  redundant  circuit  design 
has  been  developed. 

II.  REDUNDANCY  CONCEPT 

During  the  development  of  the  redundant  design,  several  guidelines  were 
established  that  seemed  appropriate  if  the  final  results  were  to  provide  an 
acceptable  system. 

First,  the  use  of  integrated  circuits  was  necessary  in  order  to  avoid  a 
size  and  fabrication  disadvantage  over  conventional  single-level  systems.  It 
might  be  noted  that  the  resultant  design  provides  a  complementary  use  in  large- 
scale  arrays  of  integrated  circuits  as  a  means  of  improving  the  yield  dilemma. 

Second,  the  operational  power  demands  clearly  should  be  low  and,  in  fact, 
it  appeared  desirable  to  reduce  the  power  to  very  low  levels  to  improve  relia¬ 
bility  and  avoid  any  power  disadvantage  usually  associated  with  redundant 
methods.  The  pulse-powered  circuit  technique  was  particularly  suited  to  this 
need,  and  had  the  added  advantage  of  noise  immunity  (error  insensitivity)  during 
the  power-off  periods. 

Third,  there  appeared  to  be  an  implied  figure  of  merit  that  should  be  ap¬ 
plied  to  a  redundant  design  in  order  to  achieve  a  reliable  and  acceptable  system. 
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The  most  appropriate  figure  of  merit  is  based  on  the  simplicity  and  basic 
reliability  of  the  interconnection  of  the  elements  in  a  station. 

Few,  if  any,  disadvantages  can  be  tolerated  in  the  error-correcting  feature 
or  the  interconnection  design,  since  the  multiplicity  implied  in  redundancy  am¬ 
plifies  these  disadvantages  so  that  they  frequently  become  dominant  factors  that 
lead  to  serious  system  degradation. 

Fourth,  an  application  of  redundancy  at  the  basic  circuit  level,  rather  than 
at  the  component  or  system  level,  leads  to  a  more  efficient  and  reliable  design. 

The  specific  design  implementation  will  be  discussed  starting  with  the  low- 
power  requirement  and  relating  each  design  characteristic  to  the  guidelines. 

III.  LOW-POWER  DESIGN 

In  order  to  achieve  low-power  operation  to  offset  the  power  required  for 
the  additional  stages  of  a  redundant  system,  two  basic  approaches  are  possible. 
Low-power  circuits  may  be  employed  but  their  inherent  noise  sensitivity,  be¬ 
cause  of  their  high  impedances,  opposes  the  primary  purpose  of  redundancy. 
Relatively  high-powered  circuits  may  be  operated  in  an  on-off  or  pulse-powered 
mode  with  very  low  average-power  levels  if  the  duty  cycle  is  low. 

The  advantage  of  pulse-powered  operation  lies  in  the  fact  that  there  can  be 
considerable  noise  immunity  in  the  low  impedances  that  exist  in  the  high-power 
circuits,  and,  of  course,  near-total  noise  immunity  during  the  power-off 
interval. 

Recently,  pulse-powered  operation  is  finding  more  application  since  it 
offers  greater  freedom  in  designing  low-impedance  circuits  for  stability  or 
noise  immunity,  yet  at  a  relatively  low  cost  in  power.  In  fact,  it  becomes 
difficult  to  justify  in  many  cases  the  expenditure  of  power  during  long  intervals 
when  no  signal  processing  use  is  made  of  a  circuit.  For  example,  in  the  case 
of  a  memory  sense  amplifier  where  stability  is  a  strong  consideration,  it  is  a 
simple  matter  to  provide  power  only  during  the  short  core  output  (l-psec) 
interval. 

In  applying  pulse-powered  design  to  digital  circuits,  a  convenient  technique 
makes  use  of  capacitors  connected  to  the  outputs,  so  that  during  nonpowered 
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intervals  the  capacitors  store  the  charge  related  to  the  prior  state  of  the 
element.  As  power  is  reapplied,  the  capacitor  charge  re-establishes  the  state 
of  the  element. 

Of  course,  it  is  necessary  to  ensure  that  the  capacitor  size  is  large  enough 

relative  to  the  clock  rate  so  that  adequate  charge  exists  at  the  succeeding  clock 

time  to  properly  re-establish  the  element  state.  Because  of  the  improved 

leakage  currents  of  present  semiconductors,  excellent  margins  can  be  obtained 

with  small  capacitor  values  even  for  long  off  periods.  However,  the  important 
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criterion  is  the  power  reduction  that  can  be  achieved,  usually  10 J  to  10°  over 
the  full-power  case. 

Figure  1(a)  is  an  example  of  a  commercial  integrated  flip-flop  operating 
in  a  pulse-  or  gated-power  mode.  The  transistor  Q5  applies  voltage  to  the 


R1.2  ■  5.1  k  +  v  R1  13-73- ?H?I 


Fig.  1(a).  Schematic  of  gated-power  flip-flop. 
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flip-flop  at  pin  8  for  short  intervals  during  the  time  its  base  goes  low.  At  the 
same  time,  the  capacitor  gate  transistors  Q3  and  Q4  are  turned  on.  The  state 
of  the  flip-flop  is  represented  by  the  charge  that  exists  on  capacitors  Cl  and 
C2  during  the  on  period.  When  the  power  gate  is  turned  off  and  voltage  is 
removed  from  the  flip-flop,  the  capacitors  begin  to  discharge  at  a  rate  deter¬ 
mined  primarily  by  the  leakage  of  Q3  and  Q4.  If  sufficient  charge  remains  at 
the  time  that  voltage  is  reapplied,  then  the  flip-flop  will  be  forced  by  collector 
triggering  into  its  prior  state  as  a  result  of  the  capacitor  charge. 

Consider  the  operation  in  more  detail.  If  voltage  is  applied  to  the  flip-flop 
through  Q5,  the  circuit  (except  for  a  small  voltage  drop  through  Q5)  is  capable 
of  normal  full-power  operation.  That  is,  it  may  be  set  or  reset  and  will  hold 
its  state  after  these  operations.  Using  Fig.  1(b)  as  a  reference  and  with  the 

|3-73-?H0|  +  V  =  4V  | - -  I - 1 
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Fig.  1(b).  Gated-power  flip-flop  timing. 
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flip-flop  collectors  C  high  and  C  low,  capacitor  Cl  is  charged  to  +V^  —  V 
where  is  the  high  level  of  the  flip-flop  and  V  ^  is  the  saturation  voltage  of 
Q3,  and  capacitor  C2  is  charged  to  —  V  where  V  ^  in  this  case  is  the 
saturation  voltage  of  Q4  and  is  the  low  level  of  the  flip-flop.  When  voltage 
is  removed  via  gate  Q5,  the  collector  points  C  and  C  drop  to  zero  and  the  col¬ 
lector  of  Q3  assumes  a  negative  voltage  equal  to  V  ^  —  V^.  At  the  same  time, 
the  collector  of  Q4  assumes  a  positive  voltage  of  V  ^  —  V^.  Since  the  satura¬ 
tion  voltage  of  Q3  and  Q4  (V  is  about  0.7  V,  and  the  flip-flop  voltage  is 
about  60  mV,  the  collector  of  Q4  is  slightly  less  than  +0.7  V.  For  the  integrated 
circuit  used  here,  V^  is  about  1.5  V  for  a  supply  voltage  (+VS)  of  +4  V,  so  that 
the  collector  of  Q3  when  gate  power  is  initially  removed  is  approximately  —0.7  V. 
During  the  off  time,  the  collector  voltage  of  Q3  begins  to  discharge  toward 
ground  from  its  negative  value,  while  the  collector  of  Q4  discharges  toward 
ground  from  its  positive  value.  When  voltage  is  reapplied  to  the  element,  the 
capacitor  gates  Q3  and  Q4  turn  on  so  that  their  collectors  immediately  assume 
a  positive  voltage  V  If  the  capacitor  Cl  did  not  discharge  totally,  then  its 
remaining  negative  voltage  (V^)  would  cause  the  C  side  of  the  flip-flop  to  as¬ 
sume  a  positive  voltage  equal  to  V  ^  —  V^.  Assuming  also  that  capacitor  C2 
did  not  discharge  completely  but  reached  a  voltage  V^,  then,  when  voltage  is 
applied  to  the  element  and  Q4  turns  on  so  that  its  collector  assumes  a  voltage 
of  V^,  the  C  side  of  the  flip-flop  must  jump  to  a  voltage  of  V^  —  V^.  The 
large  positive  voltage  V  ^  —  V,^  on  the  C  side  provides  base  current  to  the 
flip-flop  transistor  Q2,  while  the  low  voltage  V  ^  —  Vf ,  on  the  C  side  clamps 
the  flip-flop  and  prevents  the  turn  on  of  the  flip-flop  transistor  Ql.  The  final 
state  of  the  flip-flop  then  will  be  the  same  as  its  state  prior  to  removing  the 
voltage  supply. 

There  are  two  significant  features  of  the  process  just  described.  First, 
the  elements  chosen  (General  Micro-Electronics,  Inc.  type  GME  134D2)  and, 
for  that  matter,  many  of  the  available  integrated  flip-flops  will  collector  trig¬ 
ger  with  very  small  collector  charge  and,  except  that  some  care  must  be  taken 
to  avoid  circuits  having  excessively  low  trigger  thresholds,  this  will  allow 
greater  off-time  periods.  Second,  the  saturation  voltage  V  ,  of  each  capacitor 
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gate  transistor  is  about  0.7  V  and,  at  turn  on,  this  causes  the  C  and  C  sides 
to  jump  at  least  to  this  level  and  so  overcomes  the  usual  turn  on  the  threshold 
of  the  flip-flop.  Hence,  any  remaining  charge  on  the  capacitors  will  effect  a 
proper  re-establishment  of  the  flip-flop  state. 

A  computer-aided  circuit  analysis  of  the  pulse-powered  flip-flop  using 
the  CIRCUS  program  indicates  that  the  circuit  operation  is  also  aided  by 
the  nonlinear  collector  capacitance  of  the  gate  transistors.  Demonstration  of 
this  fact  has  been  verified  by  operating  the  pulse-powered  flip-flop  using  var¬ 
actors  and  switching  diodes  instead  of  the  gate  transistors.  The  analysis  also 
indicates  that  the  hole  storage  and  the  turn-on  current  level  of  the  gate  transis¬ 
tors  influence  the  overall  margins  and  dictate  the  value  of  emitter  resistor 
used.  The  computer-aided  circuit  analysis  will  be  the  subject  of  a  future 
report. 

Storage  capacitor  values  from  10  to  10,000  pf  have  been  employed,  depend¬ 
ing  on  the  duty  factor  (clock  period).  The  power  saved  in  the  pulse-powered 
mode  is  independent  of  the  capacitor  size  to  a  first  approximation,  since  the 
larger  the  capacitor  the  longer  the  off  period  allowed;  but,  the  larger  capacitor 
requires  a  longer  clock  time  (more  power)  to  charge  the  capacitor  during  the 
on  interval. 

For  small  capacitor  values,  some  care  must  be  taken  to  keep  the  hole 
storage  low'  in  the  capacitor  gate  transistors;  otherwise,  some  loss  of  capac¬ 
itor  charge  will  occur  during  the  turn-off  time,  and  for  small  capacitors  this 
may  be  an  appreciable  percentage  of  the  total  charge. 

The  pulse-powered  form  of  operation  has  inherent  noise  immunity  because 
of  its  long  off  periods,  and  further  improvement  in  its  noise  immunity  is  pos¬ 
sible  depending  on  the  system  and  clocking  design  employed.  Additional  discus¬ 
sion  on  system  noise  characteristics  will  be  provided  in  Sec.  IV. 

Having  arrived  at  a  circuit  technique  that  reduces  power  to  acceptable 
levels,  is  simple  and  integratable,  and  displays  improved  noise  characteristics, 
it  becomes  realistic  to  think  further  about  redundancy.  The  capacitor  storage 
method  used  to  re-establish  the  flip-flop  states  suggests  a  natural  means  of 
majority  type  error  correction. 

By  interconnecting  three  stages  similar  to  the  pulse-powered  flip-flop  of 
Fig.  1(a)  so  that  a  majority  charge  condition  of  the  storage  capacitors  will 
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determine  the  state  of  all  the  stages,  it  is  possible  to  achieve  an  error- 
corrective  design. 

For  our  discussion,  we  shall  consider  a  three-level  redundant  system  as 
adequate,  and  investigate  the  operational  details  and  margins  that  exist.  Fig- 
gure  2  shows  a  three-level  redundant  station  interconnected  to  provide  error  cor¬ 
rection  of  signal  processing,  and  protection  against  component  failure.  Gate 
Gq  is  schematically  equivalent  to  the  transistor  Q5  circuit  of  Fig.  1(a),  while 
gates  G^  and  G^  are  equivalent  to  transistors  Q3  and  Q4,  respectively.  The 
coupling  capacitors  C7  to  C12  are  the  interconnections  between  stages  that 
allow  a  redistribution  of  the  storage  capacitor  charges,  so  that  for  a  single 
error  the  majority  storage  capacitor  charge  will  prevail. 

IV.  ERROR-CORRECTION  PROCESS 

The  error-correction  process  begins  during  the  initial  application  of  power, 
when  the  power  gate  and  storage  capacitor  gates  are  turning  on.  Part  of  the 
charge  on  each  storage  capacitor  is  applied  to  its  respective  flip-flop  collector, 
and  some  portion  of  the  charge  is  directed  through  the  coupling  capacitors  in 
the  event  that  a  charge  difference  exists  between  the  storage  capacitors.  Minor 
charge  differences  are  possible  and,  in  fact,  likely  because  of  variations  in  the 
leakage  current  of  the  gate  transistors  associated  with  the  storage  capacitors. 
Major  charge  difference  will  exist  in  the  event  that  one  of  the  common  register 
elements  assumed  an  incorrect  state  during  the  preceding  clock  period.  In 
this  case,  a  considerable  part  of  the  total  charge  of  the  storage  capacitors 
associated  with  two  correct  register  elements  will  be  required  to  overcome 
the  opposite  charge  on  capacitors  related  to  the  incorrect  stage. 

The  error-correction  process  is  best  considered  by  assuming  that  one  of 
the  three  redundant  flip-flops  is  in  error;  that  is,  its  storage  capacitors  are 
charged  oppositely  relative  to  the  charge  on  the  storage  capacitors  associated 
with  the  correct  flip-flops.  Assuming  equal  discharge  rates  for  all  capacitors, 
it  is  clear  that  a  majority  charge  situation  will  lead  to  an  equilibrium  condition 
that  favors  correction  of  the  capacitors  with  incorrect  charge. 
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Fig.  2.  Error-correcting  register  using  GME  134D2  elements. 
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If  the  response  of  the  capacitor  gates  is  considerably  faster  than  the  flip- 
flop  in  response,  then  an  equilibrium  condition  of  the  capacitors  will  exist 
before  the  flip-flop  switching  process  is  initiated. 

The  saturation  voltage  of  the  capacitor  gate  transistors  plays  an  important 
role  in  the  correction  process.  When  the  gate  transistors  turn  on,  their  voltage 
causes  the  flip-flop  collectors  to  rise  to  a  level  equal  to  the  sum  of  the  gate 
transistor  "on"  voltage  and  the  charge  existing  on  the  capacitor  prior  to  the 
gate  turn  on. 

The  voltage  step  related  to  the  gate  transistor  "on"  voltage  overcomes  the 
inherent  threshold  of  the  flip-flop  so  that  very  small  remaining  charge  on  the 
capacitors  will  initiate  correct  turn  on  of  the  flip-flop.  In  addition,  the  gate 
transistor  voltage  modifies  the  relationship  of  the  limiting  case  for  correction, 
so  that  in  the  limiting  case  very  little  charge  on  the  correct  capacitors  is 
needed  to  overcome  a  large  charge  on  the  incorrect  capacitors. 

If,  for  example,  the  condition  shown  in  Fig.  2  is  examined,  where  flip-flops 
1  and  2  are  assumed  to  have  charged  capacitors  Cl,  C2,  C3,  and  C4  correctly, 
while  flip-flop  3  has  charged  capacitors  C5  and  C6  incorrectly  during  the  on 
time  of  the  flip-flops,  then  the  minimum  charge  condition  for  proper  error 
correction  at  the  next  turn  on  will  be 

ql  +  q3  -  q5  >  q6  -  q4  -  q2  •  (D 


If  we  assume  all  capacitors  are  of  equal  value,  the  final  voltages  on  the 
capacitors  at  the  moment  of  next  turn  on  of  the  flip-flops  necessary  to  achieve 
error  correction  will  be 


Vfl  +  V 


f3 


Vfc  >  V 


f6 


Vf4-V 


f2 


(2) 


These  final  voltages  are  a  function  of  the  flip-flop  collector  voltages  that  existed 
prior  to  the  off  condition  of  the  circuit  and  were  reduced  by  the  discharge  rate 
inherent  in  each  capacitor  gate. 

The  relationship  of  the  initial  and  final  capacitor  voltages  for  any  capacitor 
is 


V,  =  KV. 
fn  in 


(3) 
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where  K  is  a  function  of  leakage  current  and  time.  Rewriting  Eq.  (2)  using  the 
relationship  of  Eq.  (3)  gives 


(4) 


Referring  to  Fig.  2,  a  worst-case  correction  condition  will  exist  if  we  assume 
that  the  voltages  of  the  correct  capacitors  decay  much  faster  than  the  incorrect 
capacitor  voltages.  In  any  worst  case  considered,  we  will  assume  a  single 
flip-flop  error  that  then  results  in  a  two-capacitor  error.  In  this  case,  with 
flip-flop  3  in  error  and  assuming  poor  leakage  associated  only  with  the  four 
correct  capacitors,  we  have 


K5  =  K6 


Then,  solving  Eq.  (3)  and  taking  the  low-level  flip-flop  voltage  as  zero,  we 
obtain 


Since  all  initial  conditions  of  the  capacitor  voltages  are  based  on  equal  high 
levels  (V^)  for  the  flip-flops,  and  equal  saturation  levels  (Vc^n)  for  the  ca¬ 
pacitor  gates,  we  can  rewrite  Eq.  (5)  in  terms  of  the  minimum  final  voltage  of 
the  capacitors  as 


(6a) 


(6b) 
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The  inequality  of  Eqs.  (6a)  and  (6b)  indicates  that  error  correction  will  fail  when 
the  voltages  of  the  four  correct  capacitors  decay  to  half  that  of  the  incorrect 
capacitor  voltages. 

It  should  be  noted  that  this  does  not  mean  that  the  leakage  current  of  the 
gate  transistors  of  the  capacitors  storing  the  correct  charge  cannot  be  twice 
that  of  the  gate  transistors  associated  with  the  incorrect  charges.  However, 
it  does  indicate  that  if  the  decay  rate  of  the  correct  charges  is  considerably 
greater  than  the  decay  rate  of  the  incorrect  charges,  then  the  correction 
process  which  is  achieved  during  the  power  turn  on  must  occur  before  the 
correct  charges  decay  to  half  that  of  the  incorrect  charges. 

An  analysis  of  other  limiting  circuit  conditions  indicates  that  in  some 
cases  much  greater  degradation  of  correct  capacitor  charge  is  tolerable  be¬ 
fore  error  correction  fails.  For  example,  if  in  the  case  of  the  redundant  cir¬ 
cuit  in  Fig.  2  we  assume  that  the  leakage  of  the  gates  associated  with  the  two 
capacitors  Cl  and  C3  is  particularly  poor,  the  limiting  conditions  for  the  ca¬ 
pacitor  voltages  for  proper  error  correction  can  be  determined. 

Assume 

ki  =  k3 

K5  =  K2  =  K4  K6  K1  <  K5  • 

Then,  the  relationship  for  the  minimum  capacitor  (Cl)  voltage  (V^)  and  min¬ 
imum  capacitor  (C3)  voltage  (V^)  is  dependent  on  the  specific  level  of  the  flip- 
flop  high-level  V^,  which  depends  on  the  supply  voltage  VS. 

Figure  3  indicates  the  minimum  capacitor  voltage  for  proper  error  cor¬ 
rection  assuming  poor  leakage  of  one,  two,  three,  and  four  correct  capacitors, 
respectively,  and,  of  course,  a  single  flip-flop  error.  It  is  interesting  that  an 
optimum  high  level  (V^)  for  the  flip-flop  (related  to  supply  voltage)  exists  in 
the  case  of  two  and  three  degraded  capacitor  charges.  As  can  be  seen,  at  some 
supply  voltage  condition,  the  correct  capacitors  may  discharge  totally  before 
error  correction  fails.  In  the  case  of  the  four  correct  capacitors,  error  cor¬ 
rection  will  cease  when  all  four  discharge  to  half  that  of  the  incorrect  capacitor 
charges  and  is  independent  of  supply  voltage  setting.  This  last  is  a  worst-case 
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MINIMUM  RATIO  OF  CORRECT  TO  INCORRECT  CAPACITOR  VOLTAGE 


FLIP-FLOP  HIGH-VOLTAGE  LEVEL  (Vh) 

Fig.  3.  Performance  curves  for  various  capacitor  degradation. 
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situation  and,  although  it  is  unlikely  that  all  four  correct  charges  will  decay 
faster  than  the  incorrect  charges,  the  overall  design  should  be  based  on  this 
case. 

In  the  analysis  of  margins,  it  was  assumed  that  any  charge  greater  than 
zero  would  trigger  the  registers.  Even  though  very  small  charge  is  necessary 
for  collector  triggering,  we  should  expect  the  curves  of  Fig.  3  to  be  modified 
slightly  in  practice  to  account  for  the  additional  charge  required  to  initiate 
the  register  triggering.  Using  the  redundant  station  of  Fig.  2,  consider  the 
timing  associated  with  the  error  correction  shown  in  Fig.  4.  The  set  and  reset 
connections  are  reversed  on  the  lower  flip-flop  to  induce  an  error.  Following 
the  set  or  reset  clock,  the  registers  are  turned  on  for  three  power-gate  intervals. 
Correction  of  the  lower  register  occurs  on  the  first  power  turn  on  following 
the  set  or  reset  interval.  In  the  case  of  the  register  elements  shown,  the 
clock  or  power-gate  period  may  be  as  short  as  1  psec  for  100-pf  storage  ca¬ 
pacitors,  and  the  off  period  may  be  1  msec  or  greater  before  the  capacitors 
discharge  below  half  of  their  initial  charged  levels.  The  duty  factor  for  this 

_4 

timing  is  10  ,  and  the  normal  full  power  of  30  mW  required  by  these  elements 


1 3-T3-2U4  | 


POWER  GATE  (8) 

SET  (  I  ) 
RESET  (3)  ■ 

1  (6) 

2  (6) 


CORRECTED 


INDUCED  ERROR  BY  SET-RESET 
REVERSAL  ON  ELEMENT  3 


Fig.  4.  Timing  of  error-correcting  register  using 
GME  134D2  elements. 
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Fig 


.  5.  Error-correcting  register  stage  using  GME  134R  elements. 
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is  therefore  reduced  to  3  pW.  Then,  each  three-level  redundant  station  requires 
9  pW  of  power  at  the  1-kHz  clock  rate. 

For  higher  repetition  rates,  the  storage  capacitors  can  be  reduced  further 
until  the  basic  response  time  of  the  elements  is  reached.  For  smaller  capac¬ 
itors,  the  same  duty  factor  can  be  used  so  that  no  increase  in  power  over  the 
9  pW  is  necessary. 

The  eventual  limit  of  the  power  and  speed  relationship  is  primarily  related 
to  the  inherent  collector  capacitance  associated  with  the  element.  For  repeti¬ 
tion  rates  of  10  Hz  to  100  kHz,  capacitor  values  of  1000  pf  are  appropriate, 
while  repetition  rates  greater  than  100  kHz  would  allow  capacitors  of  100  pf  or 
lower. 

With  any  specific  capacitor  values,  large  repetition  rate  variations  are 
allowed.  Although  the  power  required  will  increase  as  the  repetition  rate  is 

4 

increased,  it  is  possible  to  operate  over  a  10  change  in  rate. 

Figure  5  shows  the  arrangement  for  a  shift  register  using  a  three-level 
redundant  design.  The  register  elements  are  GME  134R  units  (Fig.  6),  and 
are  synchronous  clock-gated  types.  Input  information  is  applied  to  pin  2,  and 
a  high  level  will  cause  the  C  side  of  the  flip-flop  to  assume  a  high  level.  Con¬ 
versely,  a  low  level  at  pin  2  will  cause  the  C  side  to  assume  a  low  level.  In¬ 
formation  at  pin  2  is  inhibited  while  the  shift  clock  (pin  1)  is  high,  and  it  is 
during  the  transition  of  the  shift  clock  from  its  high  to  low  level  that  informa¬ 
tion  is  transferred  into  the  register.  This  design  is  of  particular  use  in  the 
error-correction  procedure.  When  the  power  gate  receives  a  turn-on  signal 
and  applies  voltage  to  the  register,  the  shift  clock  is  arranged  to  go  to  its  high 
level.  During  the  time  the  shift  clock  is  high,  the  remaining  capacitor  charges 
from  the  previous  flip-flop  condition  will  re-establish  the  flip-flop  states.  Any 
single  error  at  the  previous  clock  interval,  or  any  error  induced  during  the 
prior  off  interval,  will  be  corrected  during  the  interval  that  the  shift  clock  is 
high.  Following  this  error  correction  and  re-establishment  of  the  flip-flop 
states,  new  information  can  be  transferred  into  the  registers  via  pin  2.  The 
new  state  of  the  flip-flops  will  recharge  the  capacitors  accordingly.  At  the  end 
of  the  power-gate  on  interval,  the  capacitors  will  hold  their  charge  until  the 
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next  clock  period,  at  which  time  re-establishment  of  the  flip-flop  states  and 
any  required  error  correction  will  occur. 

Considerable  timing  latitude  is  permissible,  but  it  is  desirable  to  avoid 
any  delay  in  the  shift  clock  signal  relative  to  the  power-gate  signal.  This 
would  allow  information  on  pin  2  to  influence  the  flip-flop  states  coincidentally 
with  the  capacitor  charges.  Similarly,  the  turn  off  of  the  capacitor  gates 
should  not  be  delayed  (by  slow  transistor  types)  past  the  power  turn-off  gate. 
Figure  7  illustrates  the  timing  arrangement. 

The  advantage  of  the  shift  register  design  is  in  its  ability  to  correct  errors 
at  the  start  of  each  clock  interval,  so  that  errors  are  not  propagated  through 
the  register.  Since  the  error  correcting  is  handled  on  a  per-clock,  per-stage 
basis,  the  three  outputs  of  the  final  register  stages  may  be  OR'd  together  with 
capacitors  if  it  is  necessary  to  convert  to  a  single  signal  line.  A  counter  (Fig.  8) 
and  its  timing  (Fig.  9)  will  hold  information  during  a  no-signal  or  no-count  input 
period. 


3-73-21761 


PERIOD 


Fig.  7.  Gated-power  flip-flop  timing. 
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Fig.  8.  Redundant  counter. 
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Fig.  9.  Redundant  counter  waveforms. 

In  determining  from  practical  tests  the  extent  of  the  noise  immunity  offered 
by  the  design  and  the  error-correcting  method,  it  is  necessary  to  consider  the 
two  primary  sources  of  system  noise.  Generally,  noise  problems  are  related 
either  to  signal-  or  power-line  noise.  Signal-line  noise  is  only  effective  during 
the  short  clock  interval,  and  then  must  cause  errors  in  more  than  one  of  the 
redundant  stages  for  the  error  correction  to  fail.  Power-line  noise  can  be 
either  asynchronous  or  synchronous,  but  the  significant  noise  time  is  during 
the  clock  interval,  so  we  shall  assume  that  synchronous  noise  prevails. 

Experimentally,  we  can  induce  noise  on  the  voltage -supply  such  that  there 
is  a  100-percent  increase  or  a  50-percent  decrease  in  the  voltage  without  errors 
occurring. 
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For  excessive  noise  environments,  another  approach  may  be  taken  which 
eliminates  the  effect  of  power-line  noise  of  nearly  any  magnitude.  Using  a  diode 
capacitor  type  filter  prior  to  the  power-gate  voltage  supply,  it  is  possible  to 
supply  the  power-gate  current  required  during  a  regular  clock  period  from  the 
capacitor  even  though  noise  reduces  the  primary  voltage  supply  to  zero.  Under 
these  conditions,  severe  noise  may  occur  as  long  as  the  capacitor  is  recharged 
before  the  next  clock  period. 

Experimental  tests  indicate  that  the  redundant  circuit  design  can  operate 
continuously  in  the  presence  of  power-line  noise  of  variable  frequency,  even 
to  the  extent  of  noise  totally  reducing  the  supply  voltage  periodically  to  a  zero 
level.  A  noise  test  of  typical  R-elements,  operating  in  a  conventional  full-power 
nonredundant  manner  compared  with  the  redundant  error-correction  design,  is 
illustrated  in  Fig.  10. 


Fig.  10.  Margin  comparison  for  noise  characteristics 
of  single-level  and  redundant  systems. 

V.  COMPONENT  FAILURE 

Although  some  qualifications  must  be  made  relative  to  component  failures 
and  their  effect  on  the  continued  operation  of  the  redundant  system,  it  can  be 
said  that  the  system  will  tolerate  almost  all  possible  single-component  failures. 

An  inoperative  flip-flop  which  is  the  result  of  any  flip-flop  failure  mechanism, 
except  an  absolute  collector  short  circuit,  will  not  cause  the  two  flip-flops  in  a 
station  to  cease  correct  operation.  Similarly,  short-circuited  or  open-gate 

transistors  will  not  cause  a  total  failure  of  the  station.  Protection  against 
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capacitor  short  circuits  (open  capacitors  are  permissible  failure  conditions) 
can  be  increased  by  the  use  of  double  capacitors  in  series. 

The  usual  problem  of  undetected  or  unknown  component  failures  because 
of  the  error-correction  ability  of  the  system  can  be  overcome  by  keeping  the 
three  power-gate  clocks  separate  and  available  at  the  system  test  connector. 
Each  channel  may  be  tested  as  a  single  system  by  activating  its  power-gate 
clock  with  the  other  two  channels  inoperative.  The  loading  of  the  two  inopera¬ 
tive  channels  will  not  seriously  affect  the  powered  channel,  and  any  failed 
components  can  be  detected  by  a  periodic  test  of  the  individual  channels. 

VI.  ADAPTIVE  OPERATION 

In  case  of  severe  environments,  such  as  excessive  unexpected  thermal  or 
radiation  levels,  the  system  can  be  arranged  so  that  it  will  adapt  to  the 
environment. 

The  basic  clock  rate  used  for  transfer  and  other  logic-processing  functions 
can  be  combined  with  an  idling  clock  that  is  used  only  for  re-establishing  the 
states  of  the  elements  for  a  recharge  of  the  storage  capacitors.  If  the  idling 
clock  rate  (synchronous  to  the  basic  clock  rate)  is  controlled  by  the  leakage 
rate  of  a  typical  semiconductor,  the  recharging  of  the  storage  capacitors  can 
be  increased  or  decreased  as  conditions  dictate.  Of  course,  the  power  required 
will  vary  as  the  idle  rate  changes,  but  this  can  be  included  in  the  original  design 
requirements. 

VII.  INTEGRATED  CIRCUIT  ARRAY  APPLICATION 

Fabrication  of  the  three-level  redundant  stations  in  a  single  package  using 
the  GME  monolithic  chips  and  thin  film  gates  has  been  initiated.  Single-power 
gates  can  be  used  for  a  number  of  stages  in  each  level.  Additional  capacitors 
may  be  added  externally  to  allow  for  different  applications. 

The  application  of  the  redundant  design  to  large-scale  arrays  (particularly 
storage  arrays)  appears  to  offer  a  different  approach  to  the  present  LSI  yield 
problem.  In  this  case,  the  pulse-power  mode  is  useful  in  reducing  the  package- 
power  problem,  and  the  error-correction  characteristic  can  be  used  to  improve 
the  yield  of  large  arrays.  Of  course,  the  final  system  would  be  operated  as  a 
single-level  array. 
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